Networking is the foundation that supports many applications on AWS. The way you architect your network helps determine how reliable, secure, and performant your applications are. In this session, we discuss the easy and secure delivery of applications to your users over the AWS global network. We answer your questions and cover multiple delivery methods that leverage Amazon CloudFront, AWS Global Accelerator, and AWS PrivateLink.

1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Securely deliver applications
with AWS
David Brown
Senior Edge Specialized Solutions
Architect
AWS
S V C 3 0 5
Philip Marcus
Enterprise Solutions Architect
AWS

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Agenda
• Delivering SaaS applications
• Delivering global applications
• Delivering global web applications

3. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS PrivateLink brings third-party services into your VPC and your
on-premises networks

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS PrivateLink: Service provider
Proxy protocol
V2 (optional)

6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS PrivateLink: Service user
Virtual private cloud
Application 1
AWS Direct
Connect
Application 2
Endpoints to AWS
services
Endpoints to your own
services
Endpoints to AWS partner
services
Interface endpoints
DNS name on the endpoints
• Publicly resolvable regional and zonal DNS
name that maps to the local IP of the
endpoints
• NLB health check aware
Accessible over AWS Direct Connect
Security group integration
Local IP, no route table entry
Can span multiple Availability Zones

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS PrivateLink: End to end

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Marketplace integration
Discoverability of the services when
customers purchase SaaS on
AWS Marketplace

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Enhancement for AWS Marketplace services: Vanity DNS
names
vpce-svc-1a2b3c4d.us-east-1.vpce.amazonaws.com
Service base DNS name
Service ID Region Subdomain
vpce-12345.vpce-svc-1a2b3c4d.us-east-1.vpce.amazonaws.com
Endpoints DNS name on client side
VPC endpoint ID
vpce-67890.vpce-svc-1a2b3c4d.us-east-1.vpce.amazonaws.com

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Enhancement for AWS Marketplace services: Vanity DNS
names
us-east-1.vpce.myexample.com
Service vanity DNS name
Region Subdomain
vpce-12345.us-east-1.vpce.myexample.com
Endpoints DNS name on client side
VPC endpoint ID
vpce-67890.us-east-1.vpce.myexample.com
Easier recognition of service
endpoints
Straightforward TLS
termination

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Enhancement for AWS Marketplace services: Service
discoverability

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Enhancement for AWS Marketplace services: Service
discoverability

13. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Global Accelerator
Availability Ease of usePerformance
Globally scale out internet-facing applications

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Key features
Global Accelerator
Static anycast IP addresses
Intelligent traffic distribution
TCP and UDP protocol support
Instant region failover
Enhanced fault tolerance
AWS global network

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Optimal endpoint selection
5 tuple
Protocol: UDP/TCP
Src IP: 1.2.3.4 Dest IP: 5.6.7.8
Src Port: 32759 Dest Port: 80
Optimal region
Hash (5 tuple)
Region: us-east-1
Region: us-west-1

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Optimal endpoint selection: Client affinity
5 tuple
Protocol: UDP/TCP
Src IP: 1.2.3.4 Dest IP: 5.6.7.8
Src Port: 32759 Dest Port: 80
Optimal region
Hash (2 tuple)
Region: us-east-1
Region: us-west-1

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Easy traffic control: Regional traffic dials
Region: us-east-1
Region: us-west-1
Dial values: Min 0%; Max 100%; Default 100%

19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Easy traffic control: Regional traffic dials
Region: us-east-1
Region: us-west-1
Dial values: Min 0%; Max 100%; Default 100%
0%

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Global Accelerator health checks
Global Accelerator

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Instant failover
us-east-1
eu-central-1
ap-southeast-1
Seattle
Madrid
Moscow

22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Using Global Accelerator
Global Accelerator
• Globally static IP addresses
• Traffic enters at edge and uses AWS backbone to region
• Support for stateful traffic (client affinity)
• Region decisioning handled by AWS
• Instant failover
• Leverage existing Elastic Load Balance (ELB) health checks
• Lack custom routing policies
• AWS-only endpoints (not good for hybrid architectures)
• Not in every AWS Region (yet)

23. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
security
performance
&
Amazon
CloudFront

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
The Amazon CloudFront secure global network

26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
CloudFront shields your origin
Local edge
locations Regional edge
cache Application
origin
Users

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
d1886tp5fhflpy.cloudfront.net?
CloudFront DNS
CloudFront POP
HTTP request lifecycle
Amazon
Route 53

28. Thank you!
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Philip Marcus
David Brown